admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fixing_prohibited_apps_spawning_cmdprompt
splunk-security_content/detections/experimental/network
T
History
research bot a1afa0fa60 updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
..
.untested
detection/experimental folder for untested detections
2020-11-06 10:37:11 -08:00
detect_arp_poisoning.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
detect_ipv6_network_infrastructure_threats.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
detect_large_outbound_icmp_packets.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
detect_outbound_smb_traffic.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
detect_port_security_violation.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
detect_rogue_dhcp_server.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
detect_snicat_sni_exfiltration.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
detect_software_download_to_network_device.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
detect_traffic_mirroring.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
detect_unauthorized_assets_by_mac_address.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
detect_windows_dns_sigred_via_splunk_stream.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
detect_windows_dns_sigred_via_zeek.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
detect_zerologon_via_zeek.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
dns_query_length_outliers___mltk.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
dnstwist_domain_names.yml
moved to experimental due to lack of testing
2021-09-09 17:30:40 -04:00
excessive_dns_failures.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
large_volume_of_dns_any_queries.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
prohibited_network_traffic_allowed.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
protocol_or_port_mismatch.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
protocols_passing_authentication_in_cleartext.yml
updating docs and package bits [ci skip]
2021-08-27 21:52:55 +00:00
remote_desktop_network_bruteforce.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
remote_desktop_network_traffic.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
smb_traffic_spike___mltk.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
smb_traffic_spike.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
tor_traffic.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
unusually_long_content_type_length.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00